The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Details
- CVSS 3.1 Base Score: 5.9
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Aug 17, 2013 |
| Apple Osx Apache | — | Apply OS X security update 2014-001Upgrade macOS to the latest version | Aug 28, 2015 | Aug 17, 2013 |
| Apple Osx Php | — | Apply OS X security update 2014-001Upgrade macOS to the latest version | Mar 3, 2014 | Aug 17, 2013 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Apr 5, 2017 | Aug 17, 2013 |
| Centos_linux | — | Upgrade ruby-tcltkUpgrade ruby-staticUpgrade ruby-docsUpgrade ruby-riUpgrade ruby-rdocUpgrade ruby-libsUpgrade ruby-irbUpgrade ruby-develUpgrade rubyUpgrade ruby-mode | Dec 1, 2016 | Aug 17, 2013 |
| Debian | — | Upgrade ruby1.8Upgrade ruby1.9.1 | Jul 30, 2024 | Aug 18, 2013 |
| Freebsd | — | Upgrade ruby18Upgrade ruby19 | Dec 10, 2025 | Jul 11, 2013 |
| Oracle Solaris | — | Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.11.0.4.0 on Solaris 11.1 | May 29, 2017 | Aug 17, 2013 |
| Oracle_linux | — | Upgrade ruby-rdocUpgrade ruby-tcltkUpgrade ruby-irbUpgrade ruby-develUpgrade ruby-libsUpgrade ruby-modeUpgrade ruby-riUpgrade rubyUpgrade ruby-staticUpgrade ruby-docs | Oct 16, 2024 | Aug 18, 2013 |
| Redhat Openshift | — | Upgrade ruby193-ruby | Oct 8, 2019 | Aug 18, 2013 |
| Suse | — | Upgrade python-xmlUpgrade ruby-develUpgrade ruby19-doc-riUpgrade ruby19Upgrade ruby-test-suiteUpgrade rubyUpgrade ruby-examplesUpgrade python-docUpgrade ruby19-devel-extraUpgrade python-cursesUpgrade ruby19-tkUpgrade python-demoUpgrade python-32bitUpgrade python-base-32bitUpgrade python-idleUpgrade ruby-doc-htmlUpgrade libpython2_6-1_0-x86Upgrade ruby-doc-riUpgrade sle-sdk-releaseUpgrade libpython2_6-1_0-32bitUpgrade ruby19-develUpgrade python-base-x86Upgrade python-x86Upgrade python-doc-pdfUpgrade pythonUpgrade python-baseUpgrade python-gdbmUpgrade python-develUpgrade ruby-tkUpgrade python-tkUpgrade libpython2_6-1_0 | Dec 12, 2013 | Aug 17, 2013 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby1.8Upgrade libruby1.8 | Nov 8, 2024 | Aug 18, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub